1. Technical Field of the Invention
This invention pertains to virtual private network (VPN) implementations, a fundamental enabler for E-business. More particularly, it relates to detecting filter collision to effect micro filter placement.
2. Background Art
Virtual Private Network (VPN) is a fundamental enabler for electronic business. IP Security, the technology VPNs are built upon, provides data encryption and authentication at the IP datagram level of TCP/IP.
A policy filter is a type of filter used to mark the place, in a larger set of filters, where a particular data protection policy is to be effected. When a new filter rule (also referred to as SPD entry) is added to a set of existing filter rules, as distinguished from replacing the entire set, the question is, where to put it? Where, relative to the other entries? This is important, since filter rules are logically processed top-to-bottom and particular IP packet may easily match more than one rule. This becomes even more important in the context of security policy decisions, which is what each connection filter rule represents. In accordance with current requirements, to ensure consistent, predictable processing, SPD entries must be ordered and the SPD must always be searched in the same order, so that the first matching entry is consistently selected. This requirement is necessary as the effect of processing traffic against SPD entries must be deterministic, but there is no way to canonicalize SPD entries.
If all the SPD entries were fairly static, a solution is to present the list of SPD entries in some suitable form to the user, who would then order it, then re-load the new ordering. Aside from the perhaps unappealing mechanics, the problem with this is that the SPD entries are not static. Both initiator and responder-mode connections require dynamically loading new connection filters. It is, therefore, not practical to expect the user to order these filters dynamically. Another approach would be to have the user specify an a priori ordering for connections started locally (say, auto-started or scheduled). The problem with this is that it adds yet another level of complexity to the already complex VPN configuration process, and does not work for responder-mode connections without even additional configuration complexity and perhaps unnecessary restrictions on responder-mode connections.
IP filter rules are processed top-to-bottom, in the order given by the user. IP security introduces a new level of complexity, because the filter rules now have to be placed in the right position dynamically by the system, since IP Security connections are dynamic. These filter rules also have to be removed dynamically. The IP Security Architecture (Internet RFC2401, and other IP Sec RFC""s) provides no guidance on how to implement these capabilities. There is, therefore, a need in the art for a system and method which gives the user direct and simple control over how its IP Security policy is enforced without requiring it to order the filter rules for each IP Security connection.
It is an object of the invention to provide an improved system and method for managing a set of filter rules associated with VPN connections.
It is a further object of the invention to provide a system and method for dynamically loading individual connection filters in a preexisting set of connection filters.
It is a further object of the invention to provide a system and method providing deterministic and unambiguous VPN connections, in a completely automated manner, that meet the customer-specified data protection policy.
It is a further object of the invention to provide a system and method of providing automated assurance that all VPN connections for a given data protection policy, actually cause data to be protected as per the policy.
It is a further object of the invention to provide for micro placement of connection filters.
In accordance with the invention, a system and method are provided for implementing an IP security policy by manually specifying the order of policy filters and thereafter automatically generating connection filters and placing them in the list of all IP filters relative to the appropriate policy filter, and relative to other existing connection filters for that policy.
Other features and advantages of this invention will become apparent from the following detailed description of the presently preferred embodiment of the invention, taken in conjunction with the accompanying drawings.